UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA JOHN DOE, a.k.a. KIDANE, Plaintiff, v. Civil Action No. 14-372 (RDM) FEDERAL DEMOCRATIC REPUBLIC OF ETHIOPIA, Defendant. MEMORANDUM OPINION AND ORDER The central question presented in this case is whether federal law permits the plaintiff, a U.S. citizen born in Ethiopia who remains active in the Ethiopian diaspora, to maintain suit in this Court against the Federal Democratic Republic of Ethiopia for its alleged surreptitious monitoring and recording of his (and his family’s) computer activities and communications in Silver Spring, Maryland. Plaintiff claims that, in doing so, Ethiopia violated Title III of the Omnibus Crime Control and Safe Streets Act of 1968 (“Wiretap Act”), 18 U.S.C. § 2510 et seq., and committed the common law tort of “intrusion upon seclusion” in violation of Maryland law. Ethiopia has appeared, but moves to dismiss on numerous grounds. As explained below, the Court concludes that the Wiretap Act does not create a private cause of action against a foreign state and that the plaintiff’s state-law tort claim is barred by the Foreign Sovereign Immunities Act (“FSIA”), 28 U.S.C. §§ 1602–1611. The Court, accordingly, GRANTS Ethiopia’s motion and dismisses the amended complaint. I. BACKGROUND For present purposes, the Court accepts at true the allegations of the amended complaint, along with the incorporated material.1 See Price v. Socialist People’s Libyan Arab Jamahiriya, 294 F.3d 82, 93 (D.C. Cir. 2002) (when reviewing “a plaintiff’s unchallenged factual allegations to determine whether they are sufficient to deprive a foreign state defendant of sovereign immunity, [the court must] assume those allegations to be true” (citations omitted)); Gordon v. United States Capitol Police, 778 F.3d 158, 163–64 (D.C. Cir. 2015) (under Federal Rule of Civil Procedure 12(b)(6), the court “must accept the complaint’s allegations as true and draw all reasonable inferences in favor of the non-moving party”). Plaintiff John Doe, who uses the pseudonym “Kidane” in connection with his political activities, is a U.S. citizen who was born in Ethiopia and has lived in the United States since obtaining asylum in the early 1990s. Dkt. 1-1 ¶ 3; Dkt. 26 at ¶¶ 3, 19, 20. At all relevant times, Kidane resided in Silver Spring, Maryland, where he has remained active “within the Ethiopian Diaspora.” Dkt. 26 ¶¶ 19, 20. He asserts that “the Ethiopian government monitors political dissidents at home and abroad . . . through the use of electronic surveillance,” id. ¶ 25, and that he was subjected to such surveillance by means of a program secretly installed on his personal computer, controlled by the Ethiopian government or its agents, and used by them to monitor and record his computer activities and communications. See id. ¶¶ 3, 5, 9. 1 Had Ethiopia presented evidence disputing the “factual underpinnings of” Kidane’s invocation of an exception to the FSIA, the Court would have been required to “go beyond the pleadings and [to] resolve any disputed issues of fact the resolution of which is necessary to a ruling upon the motion to dismiss.” Phoenix Consulting v. Republic of Angola, 216 F.3d 36, 40 (D.C. Cir. 2000). But, because Ethiopia has not done so, the Court must resolve Ethiopia’s motion based on the facts as alleged. 2 According to the complaint, in late 2012 or early 2013, Kidane’s personal computer, located at his home in Maryland, “bec[a]me infected with clandestine computer programs known as FinSpy.” Id. ¶ 4. FinSpy is “a system for monitoring and gathering information from electronic devices, including computers and mobile phones, without the knowledge of the device’s user.” Id. ¶ 6. It is allegedly “sold exclusively to government agencies and is not available to the general public.” Id.; see also id., Ex. A (describing the FinSpy product). Kidane attributes the FinSpy infection of his computer to an email “sent by or on behalf of Ethiopia that was thereafter forwarded to” him by a third party. Id. ¶ 5. The complaint does not state where the original third-party recipient was located; Ethiopia argues, however, that the content of the email, which is appended to the complaint, suggests that the original recipient may have resided in London. See id., Ex. C (translation stating, in part, “[y]ou took your family to London . . . .”). In any event, Kidane does not allege or argue that Ethiopia sent the email directly to him or to anyone else located in the United States. The email contained a Trojan Horse attachment that “trick[ed]” Kidane into opening it, Dkt. 26 ¶¶ 38, 41, “caus[ing] a clandestine client program to be surreptitiously downloaded onto his computer,” id. ¶ 5, and resulting in the installation of the FinSpy software, id. The FinSpy software allegedly “took what amounts to complete control over the operating system” of his computer. Id. According to the complaint, FinSpy contains “modules” for “extracting saved passwords from more than 20 different” programs, “for . . . recording Internet telephone calls, text messages, and file transfers transmitted through the Skype application,” “for covertly recording audio from a computer’s microphone even when no Skype calls are taking place,” “for recording every keystroke on the computer,” and “for recording a picture of the contents displayed on a computer’s screen.” Id. ¶ 36–37. 3 Kidane alleges that once FinSpy infected his computer, it “began contemporaneously recording some, if not all, of the activities undertaken by users of the computer, including [Kidane] and members of his family.” Id. He alleges that it “surreptitiously intercepted and contemporaneously recorded dozens of [his] private Skype Internet phone calls, recorded portions or complete copies of a number of [his] emails,” and copied a web search conducted by his son for a ninth-grade research assignment. Id. ¶ 3. He further avers that evidence of these activities was found in various “FinSpy trace files” on his computer. See id. ¶¶ 55–60, 64–77. These trace files included, for example, “files consistent with FinSpy’s naming convention [that] contain portions or complete copies of [Kidane’s] private and highly confidential Skype conversations.” Id. ¶ 69. Kidane further alleges that the FinSpy software installed on his computer communicated with a computer server located in Ethiopia. Id. ¶ 10. As explained in the complaint and attached exhibits, computers that have been infected with the FinSpy software typically communicate with a designated “FinSpy Master” server via a “FinSpy Relay.” Id. ¶¶ 35, 43–51, Ex. A. The “FinSpy Master” determines whether, under the applicable FinSpy license terms, a given copy of the software will be activated. Id. ¶¶ 44–45, Ex. A. Once the software is activated, the FinSpy Master “sends commands to [the] infected device[] and receives gathered information” from that device. Id. ¶ 35. According to a report attached to the complaint, “a recently acquired [FinSpy] malware sample” shows that the malware has used “images of members of the Ethiopian opposition group, Ginbot 7, as bait, and that it has communicated with a FinSpy Command & Control server in Ethiopia.” Dkt. 26, Ex. B. In particular, the malware communications “can be found in [an] address block run by Ethio Telecom, Ethiopia’s state owned telecommunications provider.” Id. Kidane alleges that “the FinSpy Relay and FinSpy Master servers with which 4 [his] computer in Maryland was controlled are located inside Ethiopia and controlled by Defendant Ethiopia,” id. ¶ 85, and that the FinSpy installation “took instructions from a FinSpy relay controlled by Defendant Ethiopia,” id. ¶ 84. He further alleges that FinSpy, but not all of the distinct trace files, “appears to have been removed” from his computer just five days after the publication of a report that disclosed “the technical details of the FinSpy Relay” used by Ethiopia. Id. ¶ 77. The complaint contains two counts: a claim under the Wiretap Act, alleging that Ethiopia illicitly intercepted Kidane’s Skype calls and “other data,” id. ¶¶ 92–100, and a claim under Maryland tort law for intrusion upon seclusion, alleging that Ethiopia unlawfully monitored and recorded Kidane’s and his family’s private computer activities, including Skype calls, emails, and web searches, id. ¶¶ 101–105. Citing a fear of retaliation against himself and his family members in the United States and Ethiopia, Kidane moved for leave to proceed pseudonymously—as either John Doe or using the name “Kidane.” See Dkt. 1-1 at 11–13. The Court granted that motion. See Dkt. 2. Ethiopia moved to dismiss the complaint, see Dkt. 27, and, after the matter was fully briefed, the Court held oral argument on Ethiopia’s motion. In light of the fact that the case presents “substantial issues relating to the interpretation and application of the Foreign Sovereign Immunities Act’s non-commercial tort exception, 28 U.S.C. § 1605(a)(5), including the discretionary function exception and the ‘entire tort’ rule,” the Court then provided the United States with the opportunity to file a brief. See Dkt. 35. The United States responded that it was “actively considering whether to file a Statement of Interest as permitted by 28 U.S.C. § 517,” and requested additional time to “complete its deliberations,” and, if appropriate, to file a 5 Statement of Interest. Dkt. 37. The United States ultimately declined, however, to file a brief at this stage of the proceeding. Dkt. 38. II. ANALYSIS Ethiopia moves to dismiss on multiple grounds, contending both that this Court lacks jurisdiction under the FSIA and that Kidane fails to state a claim under the Wiretap Act because the Act does not provide a cause of action against a foreign state. See Dkt. 27. In the ordinary course, the Court would start with the jurisdictional question, because jurisdiction is a precondition to the Court’s “power to declare the law, and when it ceases to exist, the only function remaining to the court is that of announcing the fact and dismissing the cause.” Steel Co. v. Citizens for a Better Env’t, 523 U.S. 83, 94 (1998) (quoting Ex parte McCardle, 74 US (7 Wall) 506, 514 (1868)). In Vermont Agency of Natural Resources v. United States ex rel. Stevens, 529 U.S. 765 (2000), however, the Supreme Court recognized a narrow exception to this rule. There, as here, the Court possessed Article III jurisdiction but was called upon to decide whether sovereign immunity—there, the Eleventh Amendment immunity of the state of Vermont—barred the action. Id. at 778. Before resolving that jurisdictional question, however, the Court concluded that it was appropriate to consider whether the relevant statute “permit[ed] the cause of action [Congress] create[d] to be asserted against States.” Id. at 779. As the Supreme Court explained, “[w]hen . . . two questions [of this sort] are at issue, not only is the statutory question ‘logically antecedent to the existence of’ the . . . question” of sovereign immunity, “but also there is no realistic possibility that addressing the statutory question will expand the Court’s power beyond the limits that the jurisdictional restriction has imposed.” Id. The same is true with respect to Kidane’s claim under the Wiretap Act. The question 6 whether Congress intended to subject foreign sovereigns to suit under the Wiretap Act is antecedent to the question whether Ethiopia would, under the FSIA, be immune from suit for any such violation. As in Vermont Agency of Natural Resources, moreover, resolving the statutory question first does not risk expanding the Court’s power beyond the jurisdictional limits prescribed by Congress; indeed, both the statutory and jurisdictional issues pose essentially the same question—did Congress intend to subject foreign states to suit in U.S. courts under the Wiretap Act? The Court, accordingly, starts with the question whether the Wiretap Act applies to foreign states before turning to the application of the FSIA. A. Applicability of the Wiretap Act to Foreign States The Wiretap Act imposes criminal penalties and establishes a private cause of action for, among other things, the unauthorized interception of “any wire, oral, or electronic communication.” 18 U.S.C. § 2511(1) (liability); see also id. §§ 2511(4) (criminal penalties), 2520(a) (private cause of action for civil damages). According to Ethiopia, however, the Wiretap Act does not apply to foreign states. That contention raises two distinct questions: First, does the prohibition on unauthorized interception of communications contained in section 2511(1) of the Wiretap Act apply to governmental entities? Second, if not, does the civil cause of action created in the Act nonetheless authorize private litigants to sue governmental entities, including foreign states, for violations of section 2511(1)? As usual, the Court “begin[s] with the text of the statute.” Kasten v. Saint-Gobain Performance Plastics Corp., 563 U.S. 1, 7 (2011). The prohibition of the Wiretap Act at issue in this case is found in section 2511(1)(a), which makes it a crime for “any person” to “intentionally intercept[], endeavor[] to intercept, or procure[] any other person to intercept . . . any wire, oral, or electronic communication” without lawful authorization. The term “person,” 7 in turn, is defined as “any employee, or agent of the United States or any State or political subdivision thereof, and any individual, partnership, association, joint stock company, trust, or corporation.” Id. § 2510(6). Thus, by its plain terms, the prohibition in section 2511(1)(a) does not apply to governmental entities; rather, it is limited to suits against those acting on behalf of the United States and state and local governments, other individuals, and various non- governmental entities. That reading of the statute is consistent, moreover, with the “longstanding interpretative presumption that ‘person’ does not include the sovereign,” Vermont Agency of Nat’l Res., 529 U.S. at 780, and with the legislative history of the Wiretap Act, which indicates that even though the “definition [of ‘person’] explicitly includes any officer or employee of the United States or any State or political subdivision of a State,” it excludes “the governmental units themselves,” S. Rep. No. 90-1097 (1968), reprinted in 1968 U.S.C.C.A.N. 2112, 2179. The Court, accordingly, concludes that the prohibition on unauthorized interception of wire, oral, or electronic communications contained in section 2511(1)(a) does not apply to governmental entities, much less foreign states. Kidane does not resist this line of reasoning, but instead argues that two amendments to the provision of the Wiretap Act establishing a private cause of action for civil damages, section 2520, opened the door to private suits against governmental entities, including foreign states, for violations of section 2511(1)(a) of the Act. As originally enacted in 1968, section 2520 provided a cause of action for a “person whose wire or oral communication is intercepted . . . in violation of this chapter . . . against any person who intercepts . . . such communications.” See Omnibus Crime Control and Safe Streets Act of 1968, Pub. L. No. 90-351, Title III, § 802, 82 Stat. 213 (1968) (emphasis added). In 1986, however, Congress enacted the Electronic Communications Privacy Act (“ECPA”), which—along with a more comprehensive overhaul of the privacy laws 8 to address electronic communications—modified section 2520 to permit recovery “from the person or entity which engaged in that violation [of this chapter].” Pub. L. No. 99-508, Title I, § 103, 100 Stat. 1848 (1986) (emphasis added). Then, in 2001, Congress again amended section 2520 in the PATRIOT Act. That amendment changed the relevant language to its current form, which provides that a person who has been subjected to the unlawful interception of his wire, oral, or electronic communications may sue “the person or entity, other than the United States, which engaged in that violation.” Pub. L. No. 107-56, Title I, § 223, 115 Stat. 293, 384 (2001) (codified at 18 U.S.C. § 2520(a) (2012)) (emphasis added). As Kidane correctly observes, the phrase “or entity” in section 2520(a) “logically must refer to [at least some] governmental entities in order to have meaning and effect.” Dkt. 28 at 19. A number of courts considering claims against local governments have so held.2 As they explain, “[t]he addition of the words ‘[or] entity’ can only mean a governmental entity because prior to the 1986 amendments, the definition of ‘person’ already included business entities. In order for [the addition of] the term [‘entity’ to section 2520] not to be superfluous, the term ‘entity’ [must] mean[] governmental entities.” Adams, 250 F.3d at 985. In addition, although there is no legislative history discussing ECPA’s addition of the phrase “or entity” to section 2520, ECPA simultaneously “added the same language to the civil liability provision for 2 See Adams v. City of Battle Creek, 250 F.3d 980, 985–86 (6th Cir. 2001); Garza v. Bexar Metro. Water Dist., 639 F. Supp. 2d 770, 773–75 (W.D. Tex. 2009); Williams v. City of Tulsa, 393 F. Supp. 2d 1124, 1132 (N.D. Okla. 2005); Conner v. Tate, 130 F. Supp. 2d 1370, 1373–74 (N.D. Ga. 2001); Dorris v. Absher, 959 F. Supp. 813, 820 (M.D. Tenn. 1997), aff’d in part, rev’d in part on other grounds, 179 F.3d 420 (6th Cir. 1999); PBA Local No. 38 v. Woodbridge Police Dep’t, 832 F. Supp. 808, 823 (D.N.J. 1993); Bodunde v. Parizek, No. 93-1464, 1993 WL 189941, at *3–4 (N.D. Ill. May 28, 1993); Huber v. N. Carolina State Univ., 594 S.E.2d 402, 407 (N.C. 2004). See also Organizacion JD Ltda. v. U.S. Dep’t of Justice, 18 F.3d 91, 95 (2d Cir. 1994) (holding parallel cause of action in section 2707 for violations of the Stored Communications Act covers municipality). The D.C. Circuit has not addressed the issue. 9 interception of stored wire and electronic communications” contained in 18 U.S.C. § 2707 (Stored Communications Act). Id. “The Senate [and House] Committee Report[s] summarizing [section] 2707, the parallel section for liability for intercepting stored communications, specifically state[] that the word ‘entity’ includes governmental entities.” Id.; see also S. Rep. No. 99-541, at 43 (1986), reprinted in 1986 U.S.C.C.A.N. 3555, 3597; H.R. Rep. No. 99-647 at 74 (1986). If ECPA’s addition of the word “entity” to section 2707 included “governmental entities,” Kidane posits that the same must be true for ECPA’s addition of the same language to section 2520. The 2001 amendment to section 2520 contained in the PATRIOT Act, likewise, supports the conclusion that at least some governmental entities are subject to suit for violating at least certain provisions of the Wiretap Act. The addition of the phrase “other than the United States” as a modifier of the word “entity” in section 2520(a) confirms that “entity” must cover some governmental bodies. See Garza, 639 F. Supp. 2d at 775; Williams, 393 F. Supp. 2d at 1132; Huber, 594 S.E.2d at 407. Although “[w]hat limited legislative history exists is silent on the addition of this language,” Williams, 393 F. Supp. 2d at 1132-33, the phrase “other than the United States” would have been unnecessary unless Congress understood the preceding term “entity” otherwise to encompass governmental entities. See id.; Garza, 639 F. Supp. 2d at 775; Huber, 594 S.E.2d at 407. For these reasons, the Court does not doubt that the term “entity,” as used in section 2520, refers to at least some governmental entities for some purposes. See also Seitz v. City of Elgin, 719 F.3d 654, 657–60 (7th Cir. 2013) (“The plain meaning of ‘entity’ includes government units.”). But that does not answer the question whether Congress intended to expose those entities to suits for violations of section 2511(1)(a) in particular, as opposed to suits for 10